This article sums up the current state of things well, there is currently no way to exploit RCE in real production environments.

All the pocs I've seen and tried either talk about absurd prerequisites for production environments or simply don't work at all.

The most that can be achieved between ASLR and other blocks is a simple DoS unless further vulnerabilities emerge to chain.

Related:

There isn't an easy exploit for this PHP vulnerability

https://news.ycombinator.com/item?id=50188948